@substrat-run/kernel 0.142.0 → 0.144.0

package/dist/refusals.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refusals.d.ts","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAOL,mBAAmB,EACnB,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAGjC,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,+zCA+B9B,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,cAAc,2GAE1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,QAAsC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gBAAgB,QAY5B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG7D;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAYzF;AAYD,+FAA+F;AAC/F,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,iBAAiB,GAAG,YAAY,GAAG,IAAI,CAM/E;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,qFAAqF;IACrF,OAAO,EAAE,iBAAiB,GAAG,YAAY,CAAC;IAC1C,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;CAAE,CA+BzF;AAED,gEAAgE;AAChE,OAAO,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"refusals.d.ts","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAQL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAC;AAGjC,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,+zCA+B9B,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,cAAc,2GAE1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,QAAsC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gBAAgB,QAY5B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG7D;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAYzF;AAYD,+FAA+F;AAC/F,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,iBAAiB,GAAG,YAAY,GAAG,IAAI,CAM/E;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,qFAAqF;IACrF,OAAO,EAAE,iBAAiB,GAAG,YAAY,CAAC;IAC1C,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;CAAE,CA+BzF"}

package/dist/refusals.js

@@ -187,6 +187,4 @@ export function refusalInsert(row) {
         ],
     };
 }
-/** The refused transition an operation failed with, or null. */
-export { refusedTransitionOf };
 //# sourceMappingURL=refusals.js.map

package/dist/refusals.js.map

@@ -1 +1 @@
-{"version":3,"file":"refusals.js","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,2BAA2B,EAC3B,iBAAiB,EACjB,eAAe,EACf,mBAAmB,GAEpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BjC,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG;;CAE7B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,GAAG,cAAc,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;;IAE5B,kBAAkB,CAAC,OAAO,CAAC,iDAAiD,EAAE,uCAAuC,CAAC;;;;;;;;;IAStH,cAAc;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,mFAAmF;IACnF,OAAO,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAmBD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,SAAiB,EAAE,SAAiB;IACjF,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO;IAChF,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,UAAU;QAAE,OAAO;IAC5C,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,GAAoC,CAAC,aAAa,CAAC,GAAG;QACrD,IAAI,EAAE,OAAO;QACb,SAAS;QACT,SAAS;QACT,MAAM,EAAE,UAAU,CAAE,GAA6C,CAAC,UAAU,EAAE,MAAM,CAAC;QACrF,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,IAAI;QACtC,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,MAAiB,CAAC,CAAC,CAAC,2BAA2B,CAAC;AACpG,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAI,GAA+B,CAAC,aAAa,CAAC,CAAC;IAC1D,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAeD,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAuB,CAAC;IAC3D,OAAO;QACL,GAAG,EAAE;;;kEAGyD;QAC9D,MAAM,EAAE;YACN,IAAI,EAAE;YACN,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY;YAC9B,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,OAAO;YACX,qFAAqF;YACrF,sFAAsF;YACtF,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC;YAC/B,CAAC,CAAC,QAAQ;YACV,UAAU,EAAE,IAAI,IAAI,IAAI;YACxB,UAAU,EAAE,SAAS,IAAI,IAAI;YAC7B,CAAC,CAAC,SAAS;YACX,GAAG,CAAC,gBAAgB;YACpB,KAAK,EAAE,SAAS,IAAI,IAAI;YACxB,qFAAqF;YACrF,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,kBAAkB;YACrD,GAAG,CAAC,KAAK;YACT,GAAG,CAAC,aAAa;YACjB,GAAG,CAAC,YAAY;YAChB,GAAG,CAAC,EAAE;SACP;KACF,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,OAAO,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"refusals.js","sourceRoot":"","sources":["../src/refusals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,2BAA2B,EAC3B,iBAAiB,EACjB,eAAe,EACf,mBAAmB,GAEpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BjC,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG;;CAE7B,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,GAAG,cAAc,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;;IAE5B,kBAAkB,CAAC,OAAO,CAAC,iDAAiD,EAAE,uCAAuC,CAAC;;;;;;;;;IAStH,cAAc;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,mFAAmF;IACnF,OAAO,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAChD,CAAC;AAmBD,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,SAAiB,EAAE,SAAiB;IACjF,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO;IAChF,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,UAAU;QAAE,OAAO;IAC5C,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,GAAoC,CAAC,aAAa,CAAC,GAAG;QACrD,IAAI,EAAE,OAAO;QACb,SAAS;QACT,SAAS;QACT,MAAM,EAAE,UAAU,CAAE,GAA6C,CAAC,UAAU,EAAE,MAAM,CAAC;QACrF,UAAU,EAAE,MAAM,EAAE,UAAU,IAAI,IAAI;QACtC,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,MAAiB,CAAC,CAAC,CAAC,2BAA2B,CAAC;AACpG,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,MAAM,UAAU,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAI,GAA+B,CAAC,aAAa,CAAC,CAAC;IAC1D,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAeD,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAuB,CAAC;IAC3D,OAAO;QACL,GAAG,EAAE;;;kEAGyD;QAC9D,MAAM,EAAE;YACN,IAAI,EAAE;YACN,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY;YAC9B,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,OAAO;YACX,qFAAqF;YACrF,sFAAsF;YACtF,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC;YAC/B,CAAC,CAAC,QAAQ;YACV,UAAU,EAAE,IAAI,IAAI,IAAI;YACxB,UAAU,EAAE,SAAS,IAAI,IAAI;YAC7B,CAAC,CAAC,SAAS;YACX,GAAG,CAAC,gBAAgB;YACpB,KAAK,EAAE,SAAS,IAAI,IAAI;YACxB,qFAAqF;YACrF,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,kBAAkB;YACrD,GAAG,CAAC,KAAK;YACT,GAAG,CAAC,aAAa;YACjB,GAAG,CAAC,YAAY;YAChB,GAAG,CAAC,EAAE;SACP;KACF,CAAC;AACJ,CAAC"}

package/dist/row-decode.d.ts

@@ -19,7 +19,8 @@ import { type Actor, type PermissionKey } from '@substrat-run/contracts';
  * - a REQUIRED scalar has no honest empty value, so a row that breaks one cannot be the
  *   contract shape without lying. It is collected, and `finish` throws naming every
  *   column the row broke — the strict decode this replaced, kept for exactly the part it
- *   cannot honestly relax.
+ *   cannot honestly relax. A read whose contract has a variant for such a row (the intent
+ *   journal's, #1637) uses `finishOr` and returns that instead.
  *
  * **Every value a decoder built on this returns satisfies the published schema**, which
  * is #1634's review finding carried forward: a field is only ever replaced by a value its
@@ -66,6 +67,12 @@ export declare const UNDECODED_ACTOR: Actor;
  * `decodeError`, beside this self-naming marker.
  */
 export declare const UNDECODED_PERMISSION: PermissionKey;
+/**
+ * Stored text cut to {@link QUOTED_MAX}, with `…` where it was cut — for any decoder that hands a
+ * stored value back verbatim (#1637), so an oversized one cannot ride into a report, a log line
+ * that repeats every tick, or a screen.
+ */
+export declare function capped(text: string): string;
 /** `column: message`, for the first issue a field's schema raised. */
 export declare function issueOf(column: string, error: Extract<FieldParse<unknown>, {
     success: false;
@@ -95,6 +102,14 @@ export interface RowDecoder {
     finish<R extends object>(decoded: R): R & {
         decodeError?: string;
     };
+    /**
+     * `finish`, for a read that has a variant to return instead of throwing (#1637): when a
+     * required scalar broke, `unreadable` is handed the same message `finish` would throw — every
+     * column named — and its result is returned in place of the row.
+     */
+    finishOr<R extends object, V>(decoded: R, unreadable: (decodeError: string) => V): (R & {
+        decodeError?: string;
+    }) | V;
 }
 /**
  * One row's decoder. `subject` names the row in a throw (`platform request row "01J…"`),

package/dist/row-decode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"row-decode.d.ts","sourceRoot":"","sources":["../src/row-decode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,KAAK,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,KAAK,UAAU,CAAC,CAAC,IACb;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GAC1B;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,MAAM,EAAE,aAAa,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;SAAE,CAAC,CAAA;KAAE,CAAA;CAAE,CAAC;AAEhH,oFAAoF;AACpF,MAAM,WAAW,KAAK,CAAC,CAAC;IACtB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;CAC1C;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,KAA8C,CAAC;AAE7E;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAA6D,CAAC;AAKjG,sEAAsE;AACtE,wBAAgB,OAAO,CACrB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC,OAAO,CAAC,GAC/D,MAAM,CAIR;AAED,8FAA8F;AAC9F,eAAO,MAAM,QAAQ,mBAAmB,CAAC;AAEzC,MAAM,WAAW,UAAU;IACzB,mGAAmG;IACnG,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,GAAG,CAAC,CAAC;IACjE,oFAAoF;IACpF,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC;IAC/E;;;;;OAKG;IACH,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IAC1E,mGAAmG;IACnG,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7E,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,MAAM,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACpE;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CAwDxE"}
+{"version":3,"file":"row-decode.d.ts","sourceRoot":"","sources":["../src/row-decode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,KAAK,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,KAAK,UAAU,CAAC,CAAC,IACb;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GAC1B;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE;QAAE,MAAM,EAAE,aAAa,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;SAAE,CAAC,CAAA;KAAE,CAAA;CAAE,CAAC;AAEhH,oFAAoF;AACpF,MAAM,WAAW,KAAK,CAAC,CAAC;IACtB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;CAC1C;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,KAA8C,CAAC;AAE7E;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAA6D,CAAC;AAKjG;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED,sEAAsE;AACtE,wBAAgB,OAAO,CACrB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC,OAAO,CAAC,GAC/D,MAAM,CAIR;AAED,8FAA8F;AAC9F,eAAO,MAAM,QAAQ,mBAAmB,CAAC;AAEzC,MAAM,WAAW,UAAU;IACzB,mGAAmG;IACnG,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,GAAG,CAAC,CAAC;IACjE,oFAAoF;IACpF,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC;IAC/E;;;;;OAKG;IACH,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IAC1E,mGAAmG;IACnG,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;IAC7E,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,MAAM,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE;;;;OAIG;IACH,QAAQ,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,CAAC,CAAC;CACvH;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CA0DxE"}

package/dist/row-decode.js

@@ -18,6 +18,14 @@ export const UNDECODED_ACTOR = actor.parse({ system: 'undecodable' });
 export const UNDECODED_PERMISSION = permissionKey.parse('undecodable:permission');
 /** How much of a stored scalar a `marked` field quotes back — a key, not a payload. */
 const QUOTED_MAX = 200;
+/**
+ * Stored text cut to {@link QUOTED_MAX}, with `…` where it was cut — for any decoder that hands a
+ * stored value back verbatim (#1637), so an oversized one cannot ride into a report, a log line
+ * that repeats every tick, or a screen.
+ */
+export function capped(text) {
+    return text.length > QUOTED_MAX ? `${text.slice(0, QUOTED_MAX)}…` : text;
+}
 /** `column: message`, for the first issue a field's schema raised. */
 export function issueOf(column, error) {
     const issue = error.issues[0];
@@ -36,6 +44,11 @@ export function rowDecoder(subject, contract) {
     const undecoded = [];
     const unreadable = [];
     const failed = new Set();
+    const finishOr = (decoded, onUnreadable) => {
+        if (unreadable.length)
+            return onUnreadable([...unreadable, ...undecoded].join('; '));
+        return undecoded.length ? { ...decoded, decodeError: undecoded.join('; ') } : decoded;
+    };
     return {
         failed,
         required(column, field, stored) {
@@ -58,8 +71,7 @@ export function rowDecoder(subject, contract) {
             const r = field.safeParse(stored);
             if (r.success)
                 return r.data;
-            const quoted = JSON.stringify(stored) ?? String(stored);
-            undecoded.push(`${issueOf(column, r.error)} (stored ${quoted.length > QUOTED_MAX ? `${quoted.slice(0, QUOTED_MAX)}…` : quoted})`);
+            undecoded.push(`${issueOf(column, r.error)} (stored ${capped(JSON.stringify(stored) ?? String(stored))})`);
             failed.add(column);
             return marker;
         },
@@ -83,11 +95,11 @@ export function rowDecoder(subject, contract) {
             return empty;
         },
         finish(decoded) {
-            if (unreadable.length) {
-                throw new Error(`${subject} cannot be read as a ${contract} — ${[...unreadable, ...undecoded].join('; ')}`);
-            }
-            return undecoded.length ? { ...decoded, decodeError: undecoded.join('; ') } : decoded;
+            return finishOr(decoded, (why) => {
+                throw new Error(`${subject} cannot be read as a ${contract} — ${why}`);
+            });
         },
+        finishOr,
     };
 }
 //# sourceMappingURL=row-decode.js.map

package/dist/row-decode.js.map

@@ -1 +1 @@
-{"version":3,"file":"row-decode.js","sourceRoot":"","sources":["../src/row-decode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,aAAa,EAAkC,MAAM,yBAAyB,CAAC;AA8C/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAU,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkB,aAAa,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAEjG,uFAAuF;AACvF,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB,sEAAsE;AACtE,MAAM,UAAU,OAAO,CACrB,MAAc,EACd,KAAgE;IAEhE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,OAAO,GAAG,MAAM,GAAG,EAAE,KAAK,KAAK,EAAE,OAAO,IAAI,6BAA6B,EAAE,CAAC;AAC9E,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAyBzC;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,QAAgB;IAC1D,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,OAAO;QACL,MAAM;QACN,QAAQ,CAAI,MAAc,EAAE,KAAe,EAAE,MAAe;YAC1D,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,SAAkB,CAAC;QAC5B,CAAC;QACD,QAAQ,CAAI,MAAc,EAAE,KAAsB,EAAE,MAAe;YACjE,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAI,MAAc,EAAE,KAAe,EAAE,MAAe,EAAE,MAAS;YACnE,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;YACxD,SAAS,CAAC,IAAI,CACZ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAClH,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,CAAI,MAAc,EAAE,KAAe,EAAE,MAAqB,EAAE,KAAQ;YACtE,IAAI,KAAK,GAAY,IAAI,CAAC;YAC1B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,QAAQ,EAAE,CAAC,CAAC;oBACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACnB,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAmB,OAAU;YACjC,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,wBAAwB,QAAQ,MAAM,CAAC,GAAG,UAAU,EAAE,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;YACJ,CAAC;YACD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"row-decode.js","sourceRoot":"","sources":["../src/row-decode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,aAAa,EAAkC,MAAM,yBAAyB,CAAC;AA+C/F;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAU,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;AAE7E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAkB,aAAa,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAEjG,uFAAuF;AACvF,MAAM,UAAU,GAAG,GAAG,CAAC;AAEvB;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,OAAO,CACrB,MAAc,EACd,KAAgE;IAEhE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,OAAO,GAAG,MAAM,GAAG,EAAE,KAAK,KAAK,EAAE,OAAO,IAAI,6BAA6B,EAAE,CAAC;AAC9E,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AA+BzC;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,QAAgB;IAC1D,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,QAAQ,GAAG,CACf,OAAU,EACV,YAAwC,EACJ,EAAE;QACtC,IAAI,UAAU,CAAC,MAAM;YAAE,OAAO,YAAY,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACxF,CAAC,CAAC;IACF,OAAO;QACL,MAAM;QACN,QAAQ,CAAI,MAAc,EAAE,KAAe,EAAE,MAAe;YAC1D,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,SAAkB,CAAC;QAC5B,CAAC;QACD,QAAQ,CAAI,MAAc,EAAE,KAAsB,EAAE,MAAe;YACjE,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAI,MAAc,EAAE,KAAe,EAAE,MAAe,EAAE,MAAS;YACnE,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3G,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,CAAI,MAAc,EAAE,KAAe,EAAE,MAAqB,EAAE,KAAQ;YACtE,IAAI,KAAK,GAAY,IAAI,CAAC;YAC1B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,QAAQ,EAAE,CAAC,CAAC;oBACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACnB,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAmB,OAAU;YACjC,OAAO,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC/B,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,wBAAwB,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;QACL,CAAC;QACD,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/scope-copy-ledger.d.ts

@@ -102,8 +102,6 @@ export interface CopyRestoreFence {
     notAfter: string;
     erasureEpoch: number;
 }
-/** How far inside the lease a restore must commit: five minutes, or a quarter of a short lease. */
-export declare const copyRestoreFenceMarginMs: (leaseMs: number) => number;
 /** The fence for a move whose entries were recorded no earlier than `recordedAt` (epoch ms). */
 export declare const copyRestoreFence: (moveId: string, recordedAt: number, leaseMs: number, erasureEpoch: number) => CopyRestoreFence;
 /** Whether a restore carrying `fence` may no longer land at `now` (epoch ms). */

package/dist/scope-copy-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-copy-ledger.d.ts","sourceRoot":"","sources":["../src/scope-copy-ledger.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElF;;;;;;;;;;;;;;;;;GAiBG;AAEH,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,4cAM0B,CAAC;AAEhE,eAAO,MAAM,kBAAkB,YAAa,yBAAyB,OAAO,MAAM,KAAG,MAAM,EACpD,CAAC;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,kWAM2C,CAAC;AAE9E,eAAO,MAAM,qBAAqB,YACvB,yBAAyB,YAAY,MAAM,WAAW,MAAM,OAAO,MAAM,KACjF,CAAC,MAAM,GAAG,IAAI,CAAC,EAGjB,CAAC;AAEF,uGAAuG;AACvG,eAAO,MAAM,gBAAgB,oOAG4C,CAAC;AAE1E,iGAAiG;AACjG,eAAO,MAAM,cAAc,4NAG6C,CAAC;AAEzE,8FAA8F;AAC9F,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,4bAK6E,CAAC;AAE5G,eAAO,MAAM,kBAAkB,aAAc,MAAM,WAAW,MAAM,aAAa,MAAM,KAAG,MAAM,EACnC,CAAC;AAE9D,sGAAsG;AACtG,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,sgBAMJ,CAAC;AAErC;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,yHACoF,CAAC;AAEzH;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAAG,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,CAAA;CAAE;AAE5F,uCAAuC;AACvC,MAAM,WAAW,oBAAoB;IAAG,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE;AAE/F,sGAAsG;AACtG,eAAO,MAAM,mBAAmB,UAAW,oBAAoB,GAAG,SAAS,KAAG,uBACA,CAAC;AAE/E;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,mGAAmG;AACnG,eAAO,MAAM,wBAAwB,YAAa,MAAM,KAAG,MAAuD,CAAC;AAEnH,gGAAgG;AAChG,eAAO,MAAM,gBAAgB,WACnB,MAAM,cAAc,MAAM,WAAW,MAAM,gBAAgB,MAAM,KACxE,gBAID,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,UAAW,gBAAgB,OAAO,MAAM,KAAG,OAA2C,CAAC;AAE1H,6EAA6E;AAC7E,eAAO,MAAM,yBAAyB,iFAAiF,CAAC;AAExH,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,6FACsD,CAAC;AAE7F,eAAO,MAAM,iBAAiB,MAAO,kBAAkB,KAAG,eAUxD,CAAC"}
+{"version":3,"file":"scope-copy-ledger.d.ts","sourceRoot":"","sources":["../src/scope-copy-ledger.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElF;;;;;;;;;;;;;;;;;GAiBG;AAEH,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,4cAM0B,CAAC;AAEhE,eAAO,MAAM,kBAAkB,YAAa,yBAAyB,OAAO,MAAM,KAAG,MAAM,EACpD,CAAC;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,kWAM2C,CAAC;AAE9E,eAAO,MAAM,qBAAqB,YACvB,yBAAyB,YAAY,MAAM,WAAW,MAAM,OAAO,MAAM,KACjF,CAAC,MAAM,GAAG,IAAI,CAAC,EAGjB,CAAC;AAEF,uGAAuG;AACvG,eAAO,MAAM,gBAAgB,oOAG4C,CAAC;AAE1E,iGAAiG;AACjG,eAAO,MAAM,cAAc,4NAG6C,CAAC;AAEzE,8FAA8F;AAC9F,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,4bAK6E,CAAC;AAE5G,eAAO,MAAM,kBAAkB,aAAc,MAAM,WAAW,MAAM,aAAa,MAAM,KAAG,MAAM,EACnC,CAAC;AAE9D,sGAAsG;AACtG,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,sgBAMJ,CAAC;AAErC;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,yHACoF,CAAC;AAEzH;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAAG,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,cAAc,GAAG,QAAQ,CAAA;CAAE;AAE5F,uCAAuC;AACvC,MAAM,WAAW,oBAAoB;IAAG,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE;AAE/F,sGAAsG;AACtG,eAAO,MAAM,mBAAmB,UAAW,oBAAoB,GAAG,SAAS,KAAG,uBACA,CAAC;AAE/E;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAKD,gGAAgG;AAChG,eAAO,MAAM,gBAAgB,WACnB,MAAM,cAAc,MAAM,WAAW,MAAM,gBAAgB,MAAM,KACxE,gBAID,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,sBAAsB,UAAW,gBAAgB,OAAO,MAAM,KAAG,OAA2C,CAAC;AAE1H,6EAA6E;AAC7E,eAAO,MAAM,yBAAyB,iFAAiF,CAAC;AAExH,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,6FACsD,CAAC;AAE7F,eAAO,MAAM,iBAAiB,MAAO,kBAAkB,KAAG,eAUxD,CAAC"}

package/dist/scope-copy-ledger.js

@@ -98,7 +98,7 @@ export const COPY_BACKFILL_SCOPE_SQL = 'SELECT reap_claimed_at, COALESCE(erasure
 /** Read the outcome of a backfill insert that wrote nothing, from `COPY_BACKFILL_SCOPE_SQL`'s row. */
 export const copyBackfillRefusal = (scope) => !scope ? 'missing' : scope.reap_claimed_at !== null ? 'reaping' : 'ledgered';
 /** How far inside the lease a restore must commit: five minutes, or a quarter of a short lease. */
-export const copyRestoreFenceMarginMs = (leaseMs) => Math.min(5 * 60_000, Math.floor(leaseMs / 4));
+const copyRestoreFenceMarginMs = (leaseMs) => Math.min(5 * 60_000, Math.floor(leaseMs / 4));
 /** The fence for a move whose entries were recorded no earlier than `recordedAt` (epoch ms). */
 export const copyRestoreFence = (moveId, recordedAt, leaseMs, erasureEpoch) => ({
     moveId,

package/dist/scope-copy-ledger.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-copy-ledger.js","sourceRoot":"","sources":["../src/scope-copy-ledger.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;+DAMuB,CAAC;AAEhE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAkC,EAAE,GAAW,EAAY,EAAE,CAC9F,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;6EAMwC,CAAC;AAE9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAAkC,EAAE,QAAgB,EAAE,OAAe,EAAE,GAAW,EAC/D,EAAE,CAAC;IACtB,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,IAAI,IAAI;IAC/F,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM;CACvC,CAAC;AAEF,uGAAuG;AACvG,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;yEAGyC,CAAC;AAE1E,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAG;;;wEAG0C,CAAC;AAEzE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;2GAK0E,CAAC;AAE5G,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,OAAe,EAAE,SAAiB,EAAY,EAAE,CACnG,CAAC,SAAS,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAK9D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;;wDAEa,gBAAgB;;;0FAGkB,gBAAgB;oCACtE,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAClC,sHAAsH,CAAC;AAazH,sGAAsG;AACtG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAuC,EAA2B,EAAE,CACtG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AAsB/E,mGAAmG;AACnG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAEnH,gGAAgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAAc,EAAE,UAAkB,EAAE,OAAe,EAAE,YAAoB,EACvD,EAAE,CAAC,CAAC;IACtB,MAAM;IACN,QAAQ,EAAE,IAAI,IAAI,CAAC,UAAU,GAAG,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE;IAC1F,YAAY;CACb,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAuB,EAAE,GAAW,EAAW,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAE1H,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,8EAA8E,CAAC;AAexH,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GACpC,0FAA0F,CAAC;AAE7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAqB,EAAmB,EAAE,CAAC,CAAC;IAC5E,QAAQ,EAAE,CAAC,CAAC,SAAqB;IACjC,OAAO,EAAE,CAAC,CAAC,QAAmB;IAC9B,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,MAAM,EAAE,CAAC,CAAC,OAAO;IACjB,KAAK,EAAE,CAAC,CAAC,KAAiC;IAC1C,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;IACrE,UAAU,EAAE,CAAC,CAAC,WAAW;CAC1B,CAAC,CAAC"}
+{"version":3,"file":"scope-copy-ledger.js","sourceRoot":"","sources":["../src/scope-copy-ledger.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AAEH,8FAA8F;AAC9F,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;+DAMuB,CAAC;AAEhE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAkC,EAAE,GAAW,EAAY,EAAE,CAC9F,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAExC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;6EAMwC,CAAC;AAE9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAAkC,EAAE,QAAgB,EAAE,OAAe,EAAE,GAAW,EAC/D,EAAE,CAAC;IACtB,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,QAAQ,IAAI,IAAI;IAC/F,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM;CACvC,CAAC;AAEF,uGAAuG;AACvG,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;yEAGyC,CAAC;AAE1E,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAG;;;wEAG0C,CAAC;AAEzE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;2GAK0E,CAAC;AAE5G,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAE,OAAe,EAAE,SAAiB,EAAY,EAAE,CACnG,CAAC,SAAS,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAK9D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;;wDAEa,gBAAgB;;;0FAGkB,gBAAgB;oCACtE,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAClC,sHAAsH,CAAC;AAazH,sGAAsG;AACtG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAuC,EAA2B,EAAE,CACtG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;AAsB/E,mGAAmG;AACnG,MAAM,wBAAwB,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAE5G,gGAAgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAAc,EAAE,UAAkB,EAAE,OAAe,EAAE,YAAoB,EACvD,EAAE,CAAC,CAAC;IACtB,MAAM;IACN,QAAQ,EAAE,IAAI,IAAI,CAAC,UAAU,GAAG,OAAO,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE;IAC1F,YAAY;CACb,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAuB,EAAE,GAAW,EAAW,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAE1H,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,8EAA8E,CAAC;AAexH,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GACpC,0FAA0F,CAAC;AAE7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAqB,EAAmB,EAAE,CAAC,CAAC;IAC5E,QAAQ,EAAE,CAAC,CAAC,SAAqB;IACjC,OAAO,EAAE,CAAC,CAAC,QAAmB;IAC9B,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,MAAM,EAAE,CAAC,CAAC,OAAO;IACjB,KAAK,EAAE,CAAC,CAAC,KAAiC;IAC1C,SAAS,EAAE,CAAC,CAAC,UAAU;IACvB,QAAQ,EAAE,CAAC,CAAC,QAAQ;IACpB,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;IACrE,UAAU,EAAE,CAAC,CAAC,WAAW;CAC1B,CAAC,CAAC"}

package/dist/scope-host.d.ts

@@ -1,9 +1,10 @@
 import type { ModuleLog } from './module-log.js';
+import type { BoundOperations } from './module-operations.js';
 import type { DeliveryRefusal } from './delivery-refusal.js';
 import type { ScopeRoleHolder } from './scope-role-admin.js';
 import type { ScopeCopyBackfillResult } from './scope-copy-ledger.js';
 import type { SubjectRedactionCounts } from './subject-redaction.js';
-import type { OnBehalfOf, ExportReadInput, ExportedBatch, ImportBatch, ImportedEvent, ImportResult, ImportState, ImportCursorMove, ImportCursorMoved, AdminAction, BecomeCapabilityInput, CapabilityExchange, CapabilityFilter, CapabilityId, CapabilityPage, MintedCapability, ListPage, ConnectLink, ConnectLinkConsume, ConnectLinkFilter, ConnectLinkKey, ConsumeConnectLinkInput, MintConnectLinkInput, Connection, ConnectionFilter, ConnectionId, ConnectionGrant, ConnectionGrantRecord, ConnectionSecret, CreateConnectionInput, OpenConnection, ProjectedConnectionGrant, ProjectedConnectionKey, AccessLogEntry, DelegatedReadRecord, OwnerTransferAudit, MemberChangeAudit, PeerBindingAudit, CopyMarkAudit, BindHostnameInput, AdminLogEntry, OpsFailureEntry, PlatformRequestDrainTotalsEntry, SweepRunEntry, SweepRunKind, SweepRunOutcome, ModelUsageEntry, ModelUsageSummary, CapabilityGrant, CreateTenantInput, Decision, Instant, DomainEvent, DomainEventInput, PlatformRequestInput, PlatformRequestId, PlatformRequest, PlatformRequestFilter, PlatformRequestStatus, PlatformRequestFailure, PlatformOutcomeEvent, EntitlementGrant, EntitlementGrantInput, EntitlementView, MeterReading, ScopeStorageSample, EntityRef, IdentityLink, IdentityPool, Jurisdiction, ModuleId, ModuleManifest, ScheduleSpec, SystemGrant, PeerGrantsStatusEntry, SystemGrantsStatusEntry, SystemSwitchRecord, SystemSwitch, SystemSwitchResult, PeerCoverage, PeerSwitch, PeerSwitchResult, VerticalCaller, VerticalResolution, PeerBinding, PeerInstanceResolution, CreateOrgInput, Node, Org, OrgId, OrgMembership, PermissionKey, PlatformActorId, ChannelName, ExportBreak, ChannelHistoryEntry, DnsRecord, HostnameBinding, HostnameStatus, PromotionAcknowledgement, BindAcknowledgement, PublishVersionInput, RegisterVerticalInput, VerticalServingState, RouteTarget, DirectoryDump, IdentityMembership, PrincipalId, ResolvedIdentity, RoleAssignment, RoleDefinition, QueryScopeInput, ReadScopeTableInput, Scope, ScopeDump, SubjectShredReceipt, ScopeQueryResult, ScopeId, ScopeStatus, ScopeTable, DenialFilter, DenialSummary, RefusalFilter, RefusalRecord, PermissionDenial, Coverage, BeginImpersonationInput, ImpersonationFilter, ImpersonationSession, ImpersonationSessionId, ScopeTablePage, StorageShape, Tenant, TenantId, TenantRole, TenantStoreHandle, AttachmentRecord, BlobStoreHandle, Visibility, Vertical, VerticalChannel, VerticalVersion, TenantStatus, Page, CountedPage, FreshnessSpec, EntityHistoryInput, EventFacetInput, EventCauseInput, EventEffectsInput, EffectsTree, InvocationEventsInput, InvocationEvents, DeadLettersInput, DeadLetter, LifecycleFlowInput, LifecycleFlowResult, OperationSeriesInput, OperationSeriesResult, CauseChain, EventFacetResult, HistoryEntry, ErrorCode, PlatformRequestFailureOrigin, IssueEntry, IssueStatus, IssueStatusInput, FindingEntry, FindingFilter, FindingRuleEntry, FindingRuleInput, FindingStatusInput, DeclaredMigration, CheckSubject, EntityGrantShape } from '@substrat-run/contracts';
+import type { OnBehalfOf, ExportReadInput, ExportedBatch, ImportBatch, ImportedEvent, ImportResult, ImportState, ImportCursorMove, ImportCursorMoved, AdminAction, BecomeCapabilityInput, CapabilityExchange, CapabilityFilter, CapabilityId, CapabilityPage, MintedCapability, ListPage, ConnectLink, ConnectLinkConsume, ConnectLinkFilter, ConnectLinkKey, ConsumeConnectLinkInput, MintConnectLinkInput, Connection, ConnectionFilter, ConnectionId, ConnectionGrant, ConnectionGrantRecord, ConnectionSecret, CreateConnectionInput, OpenConnection, ProjectedConnectionGrant, ProjectedConnectionKey, AccessLogEntry, DelegatedReadRecord, OwnerTransferAudit, MemberChangeAudit, PeerBindingAudit, CopyMarkAudit, BindHostnameInput, AdminLogEntry, OpsFailureEntry, PlatformRequestDrainTotalsEntry, SweepRunEntry, SweepRunKind, SweepRunOutcome, ModelUsageEntry, ModelUsageSummary, CapabilityGrant, CreateTenantInput, Decision, Instant, DomainEvent, DomainEventInput, PlatformRequestInput, PlatformRequestId, PlatformRequestEntry, PlatformRequestFilter, PlatformRequestStatus, PlatformRequestFailure, PlatformOutcomeEvent, EntitlementGrant, EntitlementGrantInput, EntitlementView, MeterReading, ScopeStorageSample, EntityRef, IdentityLink, IdentityPool, Jurisdiction, ModuleId, ModuleManifest, ScheduleSpec, SystemGrant, PeerGrantsStatusEntry, SystemGrantsStatusEntry, SystemSwitchRecord, SystemSwitch, SystemSwitchResult, PeerCoverage, PeerSwitch, PeerSwitchResult, VerticalCaller, VerticalResolution, PeerBinding, PeerInstanceResolution, CreateOrgInput, Node, Org, OrgId, OrgMembership, PermissionKey, PlatformActorId, ChannelName, ExportBreak, ChannelHistoryEntry, DnsRecord, HostnameBinding, HostnameStatus, PromotionAcknowledgement, BindAcknowledgement, PublishVersionInput, RegisterVerticalInput, VerticalServingState, RouteTarget, DirectoryDump, IdentityMembership, PrincipalId, ResolvedIdentity, RoleAssignment, RoleDefinition, QueryScopeInput, ReadScopeTableInput, Scope, ScopeDump, SubjectShredReceipt, ScopeQueryResult, ScopeId, ScopeStatus, ScopeTable, DenialFilter, DenialSummary, RefusalFilter, RefusalRecord, PermissionDenial, Coverage, BeginImpersonationInput, ImpersonationFilter, ImpersonationSession, ImpersonationSessionId, ScopeTablePage, StorageShape, Tenant, TenantId, TenantRole, TenantStoreHandle, AttachmentRecord, BlobStoreHandle, Visibility, Vertical, VerticalChannel, VerticalVersion, TenantStatus, Page, CountedPage, FreshnessSpec, EntityHistoryInput, EventFacetInput, EventCauseInput, EventEffectsInput, EffectsTree, InvocationEventsInput, InvocationEvents, DeadLettersInput, DeadLetter, LifecycleFlowInput, LifecycleFlowResult, OperationSeriesInput, OperationSeriesResult, CauseChain, EventFacetResult, HistoryEntry, ErrorCode, PlatformRequestFailureOrigin, IssueEntry, IssueStatus, IssueStatusInput, FindingEntry, FindingFilter, FindingRuleEntry, FindingRuleInput, FindingStatusInput, DeclaredMigration, CheckSubject, EntityGrantShape } from '@substrat-run/contracts';
 import type { ConnectionUseOutcome } from './connector-calls.js';
 import type { CapabilityVerbs } from './capability.js';
 import type { AuditedOperationRef, AuditedOperationRow } from './audit-outcome.js';
@@ -186,8 +187,14 @@ export interface OperationContext {
      *
      * Read-only by construction: the kernel owns every write to this table (rule 3 forbids module
      * code writing `_substrat_*`), so an intent's status is only ever the platform's answer.
+     *
+     * **A row whose identity does not decode comes back as an `UndecodablePlatformRequest`**
+     * (#1637) — its id, kind, status, attempts or time as stored, and why — beside every other row,
+     * instead of throwing for the whole list. Narrow with `isUndecodablePlatformRequest` before
+     * reading anything else. Only a restored dump can hold such a row; a healthy journal never
+     * returns one.
      */
-    platformRequests(filter?: PlatformRequestFilter): PlatformRequest[];
+    platformRequests(filter?: PlatformRequestFilter): PlatformRequestEntry[];
     /**
      * This entity's version (#901) — the ULID of the last event about it, or
      * `null` if nothing has ever been emitted about it.
@@ -1505,86 +1512,28 @@ export declare function consumersFor<const C extends readonly EventContract[]>()
 export interface ModuleRegistration<C extends readonly EventContract[] = []> {
     manifest: ModuleManifest;
     migrations?: SqlMigration[];
-    operations?: Record<string, OperationHandler<never, unknown>>;
-    /**
-     * name → the schema the host parses an invocation's input against, BEFORE the
-     * guards and the handler see it (#893).
-     *
-     * Derived from the declared operation surface — `operationInputsOf(ops)` — and
-     * never written a second time. A module that declares its operations gets the
-     * parse by handing the same object over:
-     *
-     * ```ts
-     * operations: { 'rally/book': bookOp, … },
-     * operationInputs: operationInputsOf(rallyOperations),
-     * ```
-     *
-     * **This is where "parse, don't trust" is kept, rather than in 85 handlers.**
-     * `OperationShape.input` calls itself *"the SAME Zod object the handler
-     * parses"* and across the fleet it mostly was not — rally declared 32 inputs
-     * and parsed 2. One place that cannot be forgotten beats a rule every new
-     * operation has to remember, which is the same argument `mountOperations`
-     * already makes for the page trio.
-     *
-     * A name here that no operation binds is an error: it is a schema enforcing
-     * nothing, and it reads as coverage. A bound operation with no entry is
-     * allowed and means what it always meant — nothing was declared to parse.
-     *
-     * **It also carries the declared surface (#119).** `operationInputsOf` records, for the frozen
-     * map it returns, every declared operation and the entity each addresses by id. The host DERIVES
-     * its trash refusal from that — nothing else is handed over — and a module with a trashable
-     * entity must pass that map as returned, with every operation it binds declared in it.
-     *
-     * Typed structurally rather than as `z.ZodType` so the kernel keeps its single
-     * dependency and no zod version is pinned by the scope-host contract. The
-     * shape is the whole surface the host uses: throw to refuse, return the value
-     * to accept.
-     */
-    operationInputs?: Record<string, {
-        parse(value: unknown): unknown;
-    }>;
     /**
-     * name → the entity whose version this operation's `If-Match` is compared
-     * against, and the input field carrying its id (#129).
-     *
-     * Derived from the declared operation surface — `operationConcurrencyOf(ops)` —
-     * and never written a second time, exactly as `operationInputs` is:
+     * The module's operations: its handlers and, derived from their declaration, the input schemas
+     * the host parses with, the `If-Match` concurrency map and the idempotency opt-outs (#1835).
+     * From `operationsFor(declaration)(handlers)` or, for a module with no declared surface,
+     * `undeclaredOperations(reason, handlers)` — never an object literal:
      *
      * ```ts
-     * operations: { 'callout/update-customer': updateCustomerOp, … },
-     * operationInputs: operationInputsOf(calloutOperations),
-     * operationConcurrency: operationConcurrencyOf(calloutOperations),
+     * ...operationsFor(rallyOperations)({ 'rally/book': bookOp, … }),
      * ```
      *
-     * **The host compares, not the handler.** A precondition a handler evaluates is
-     * a precondition a handler can forget, and the one that is forgotten is
-     * indistinguishable from one that passed. Here the comparison happens between
-     * `BEGIN` and the guards for every caller and every transport, or the operation
-     * does not claim to have it.
-     *
-     * A name here that no operation binds is an error, for the same reason it is on
-     * `operationInputs`: it reads as coverage while enforcing nothing.
-     */
-    operationConcurrency?: Record<string, {
-        entity: string;
-        idFrom: string;
-    }>;
-    /**
-     * The operations that declared `idempotency: false` (#116) — the ones whose
-     * response must not be recorded, and which therefore refuse an
-     * `Idempotency-Key` instead of honouring it.
-     *
-     * Derived like the two above, and never written a second time:
-     *
-     * ```ts
-     * operationIdempotencyOptOuts: operationIdempotencyOptOutsOf(calloutOperations),
-     * ```
+     * **This is where "parse, don't trust" is kept, rather than in 85 handlers** (#893).
+     * `OperationShape.input` calls itself *"the SAME Zod object the handler parses"* and across
+     * the fleet it mostly was not — rally declared 32 inputs and parsed 2. The schemas, the
+     * concurrency the host compares between `BEGIN` and the guards (#129) and the opt-outs (#116)
+     * used to be three more optional fields beside the handlers, so a module could hand over the
+     * handlers and forget the rest, or pair them with another declaration's. One value closes both.
      *
-     * A list of refusals rather than a list of participants, because that is what
-     * the declaration is. Absent means every operation honours a key, which is the
-     * default and the reason there is nothing to remember.
+     * A schema or a concurrency entry naming no bound operation is an error: it enforces nothing
+     * and reads as coverage. The inputs also carry the declared surface (#119) the host derives
+     * its trash refusal from, so a module with a trashable entity must bind through `operationsFor`.
      */
-    operationIdempotencyOptOuts?: readonly string[];
+    operations?: BoundOperations;
     /**
      * eventType → handler; the types must appear in manifest.events.consumes.
      *
@@ -1721,11 +1670,22 @@ export interface HostAdmin {
      * something was fully shared with as a holder.
      *
      * Bounded: `batch` rows of work (default 500, an integer from 1 to 5000, or `validation_failed`)
-     * per scope transaction, backfill included, repeated until a pass finishes — so it is safe
-     * on a large scope, and finishes on a re-run if interrupted. Each (person, entity) topped up is
+     * per scope transaction, backfill included, and at most ten rows read per row of work: markers
+     * on their own index (#2083), and the backfill's candidates in an index order (#2154; a table
+     * holder's `idColumn` must lead an index for that, and a scope where it does not writes a
+     * `shape-backfill-unbounded` warn line). Each pass resumes where the last one stopped, until one finds
+     * nothing left, so it is safe on a large scope whether or not anything changed, and finishes on
+     * a re-run if interrupted. A holder an older deployment grants the shape to while it runs, behind
+     * the point it has reached: if they lack a key the shape gained, the next reconcile tops them up.
+     * If they hold a key the shape retired, a confirming walk from the first marker, which every
+     * retirement runs before it records itself finished, takes it back. Only a grant landing behind
+     * that confirming walk keeps the key, as one landing after the retirement finished does. Each (person, entity) topped up is
      * an `entity.grants-topped-up` event on the entity, and each one retired keys were taken from an
      * `entity.grants-retired` event. Audited as `reconcileEntityGrantShapes` when it changed
-     * anything. Returns how many (person, entity) it topped up, and how many it retired keys from.
+     * anything. Returns how many (person, entity) it topped up, and how many it retired keys from;
+     * plus, only when nonzero, `retirementsLeftOpen`: shapes whose retirement kept meeting new
+     * grants of a retired key (`SHAPE_RETIRE_CONFIRMS_MAX` confirming walks that took keys) and was
+     * left for the next reconcile to run again, unrecorded.
      */
     reconcileEntityGrantShapes(actor: PlatformActorId, node: {
         tenantId: TenantId;
@@ -1735,6 +1695,7 @@ export interface HostAdmin {
     }): Promise<{
         toppedUp: number;
         retired: number;
+        retirementsLeftOpen?: number;
     }>;
     /** Grant to an organization (portal customers); members reach it via membership tuples. */
     /**
@@ -4921,8 +4882,11 @@ export interface ScopeHost {
      * `ctx.requestPlatform` awaiting the platform's drain. Fleet maintenance, no actor (the same
      * class as `drainDue`). The platform reads these, executes each with `HostAdmin` authority, and
      * journals the outcome via `settlePlatformRequest` — the read-here/effect-there executor shape.
+     *
+     * A row whose identity does not decode is returned as an `UndecodablePlatformRequest` (#1637),
+     * never thrown for the queue; the drain runs no handler on one.
      */
-    listPlatformRequests(tenantId: TenantId, scopeId: ScopeId): Promise<PlatformRequest[]>;
+    listPlatformRequests(tenantId: TenantId, scopeId: ScopeId): Promise<PlatformRequestEntry[]>;
     /**
      * The scope's intent JOURNAL — every intent in whatever state it settled, newest first (#618).
      *
@@ -4933,9 +4897,11 @@ export interface ScopeHost {
      * SQL. This is the read that surfaces it: `kind` narrows to one intent family
      * (`connector:scrive`), `status` to one outcome, `limit` to a recency window.
      *
-     * Fleet maintenance, no actor — same class as the pending read it complements.
+     * Fleet maintenance, no actor — same class as the pending read it complements. Returns an
+     * `UndecodablePlatformRequest` for a row whose identity does not decode (#1637), as the
+     * pending read does.
      */
-    listPlatformRequestHistory(tenantId: TenantId, scopeId: ScopeId, filter?: PlatformRequestFilter): Promise<PlatformRequest[]>;
+    listPlatformRequestHistory(tenantId: TenantId, scopeId: ScopeId, filter?: PlatformRequestFilter): Promise<PlatformRequestEntry[]>;
     /**
      * Journal a platform-request outcome after the coordinator ran it: `done`, `failed` (terminal),
      * or `pending` (transient — retried on a later drain). `result` persists across retries (a
@@ -5089,26 +5055,6 @@ export interface LiveReadSurface<Req extends LiveUpgradeRequest = LiveUpgradeReq
         expiresAt?: string;
     }): Promise<Res>;
 }
-/**
- * The close codes a live socket ends with, so a client can tell "try again" from "poll".
- *
- * - `1008` (policy): the subscriber may no longer watch what it subscribed to — a
- *   `checkedWithin` gate refused, or the session that opened it ended. A reconnect meets
- *   the handshake's own refusal.
- * - `4429`: this principal already holds `LIVE_SOCKETS_PER_PRINCIPAL` sockets on the scope.
- *   Not a reason to retry: the client should poll, which it does anyway, and stop asking.
- */
-export declare const LIVE_CLOSE: {
-    readonly revoked: 1008;
-    readonly tooMany: 4429;
-};
-/**
- * How many live sockets one principal may hold on one scope (#938). A tab holds one per
- * feed (the desk's, and one per open conversation in ticket0's portal), and each socket is
- * work on every post-commit pass, so a principal opening more is a cost on everybody else
- * writing to the scope. Eight covers several tabs; past it a socket is closed `4429`.
- */
-export declare const LIVE_SOCKETS_PER_PRINCIPAL = 8;
 /** The brand only `vouchedWithin` can apply — a literal cannot type-check as one. */
 declare const vouchedBrand: unique symbol;
 /**